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The first quantum algorithm to offer an exponential speedup (in the query complexity setting) 
over classical algorithms was Simon's algorithm for identifying a hidden exclusive-or mask. Here we 
observe how part of Simon's algorithm can be interpreted as a Clebsch-Gordan transform. Inspired 
by this we show how Clebsch-Gordan transforms can be used to efficiently find a hidden involution 
on the group G" where G is the dihedral group of order eight (the group of symmetries of a square.) 
This problem previously admitted an efficient quantum algorithm but a connection to Clebsch- 
Gordan transforms had not been made. Our results provide further evidence for the usefulness of 
^■r ^ , Clebsch-Gordan transform in quantum algorithm design. 
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I. INTRODUCTION 



The most widely known computational task under which quantum computers outperform classical computers is 
for the problem of factoring an integer This can be done in polynomial time on a quantum computer using 
Shor's algorithm, while the best classical algorithm requires superpolynomial time to complete this task. Since the 
problem of factoring is the basis upon which the security of the most widely used public key cryptosystems is built 0] , 
Shor's algorithm is a threat to the security of our modern computer infrastructure. While this is certainly of great 
importance, a question which has been burning a hole in the theoretical quantum computing community is what 
other problems can be exponentially sped up using a quantum computer. Of particular significance are algorithms 
Q"* for the nonabelian hidden subgroup problem (defined below), as an efficient algorithm for these problems over the 
appropriate groups would lead to efficient algorithms for graph isomor phism [III B 1 

and certain unique shortest 

I | vector in a lattice problems Q • 
■ The first quantum algorithm which showed an exponential speedup (in the query complexity setting) over classical 

■^J- ' algorithms was the problem considered by Simon [8[. In Simon's problem, one is given access to a function on n 

r~~- , bits which is guaranteed to be constant and distinct on an unknown XOR mask and the goal of the problem is to 
identify this hidden XOR mask. In the language of the hidden subgroup problem [H, Q , Simon's problem is the hidden 
subgroup problem over the abelian group ZJ? with the hidden subgroups being order two subgroups (involutions.) 

00 ' Simon's algorithm consists of two components, one in which a Fourier transform over ZJJ is applied, and second step 
in which the hidden subgroup is extracted from many samples of the first part and the use of Gaussian elimination. 
Interestingly the first of these tasks follows naturally from symmetry considerations, while the second, at first glance, 

^\ ' does not appear to follow from symmetry arguments. Here we observe that, upon further reflection, the Gaussian 
^ . elimination in Simon's algorithm can indeed be interpreted in terms of symmetry In particular we observe that this 
step can be recast as a Clebsch-Gordan transform over Z£ . Recentl y C lebsch-Gordan transforms have emerged as a 

IjS , tool for solving some non- Abelian hidden subgroup problems [9l [ToL TTTI] . 

A natural generalization of Simon's problem is to consider the hidden subgroup problem over n copies of a constant 
sized finite non- Abelian group, i.e. the group Q n , and consider the problem of hidden involutions for this group. 
Recently Alagic, Moore, and Russell [l(| have found subexponential, but still superpolynomial, time algorithms for 
this problem, under a certain representation theoretic restriction on the group Q . Their algorithm relies on a method 
known as Clebsch-Gordan sieving, in which one uses a partial Clebsch-Gordan transform to sieve out particular 
irreps. We have argued previously that beyond Clebsch-Gordan sieving one also needs to use information stored in 
the multiplicity register of a Clebsch-Gordan transform in a coherent fashion to solve hidden subgroup problems [Til ] . 
Interestingly, there are groups, Q ', for which the hidden subgroup problem is already known to admit efficient quantum 
algorithms (besides the obvious Abelian cases.) For example, if Q is T>4, the dihedral group of order eight, then the 
hidden involution problem over 2?™, then the algorithm of Friedl, Ivanyos, Magniez, Santha, and Sen [121 ] efficiently 
solves this problem (since D\ is a solvable group having a smoothly solvable commutator subgroups). When applying 
the algorithm of Alagic, Moore, and Russell [101 ] to this group one obtains a superpolynomial time quantum algorithm 
for DJ. Is there a way to design a hidden subgroup problem algorithm which uses Clebsch-Gordan transforms, but 
not Clebsch-Gordan sieving, for this group? Here we show how a quantum computer can efficiently solve such a 
hidden involution problem by using a multiplicity space algorithm for X>J. While we do not obtain a new efficient 
quantum algorithm, we are able to show how Clebsch-Gordan multiplicity space algorithms can be developed and lead 
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to polynomial time quantum algorithms. We present this as more evidence that multiplicity space Clebsch-Gordan 
transforms are a viable new tool for efficiently solving hidden subgroup problems. 



II. THE HIDDEN SUBGROUP PROBLEM 

The hidden subgroup problem has a long and vexing history in quantum computing (see [l3| for a review of this 
problem. Note however that a considerable amount of progress has been made on this problem since this review was 
written.) After Shor's discovery of efficient quantum algorithms for factoring and computing the discrete logarithm 
it was quickly realized that these problems could be seen as instances of the hidden subgroup problem over abelian 
groups 2, 0, EH- The hidden subgroup problem is defined as follows: 

Hidden Subgroup Problem. (HSP) Let / be function from a group Q to a set S which is promised to 
be constant and distinct on different left cosets of an unknown subgroup H: f(g) — /(<?') iff gH = g'H. 
The goal of the hidden subgroup problem is, by querying /, to identify the subgroup H. An algorithm for 
the hidden subgroup problem is efficient if the running time is polynomial in log \ Q\. 

The hidden subgroup problem can be efficiently solved in a variety of cases, inclu ding when t he g roup is Abelian, the 
subgroups are normal, the group is extraspecial and more [12, EH, EH, 113, EH, EU 0, HH, HH l23j | Two notable cases 
where there is no known efficient quantum algorithm for the hidden subgroup problem are the symmetric group hidden 
subgroup problem and the dihedral group hidden subgroup problem. An efficient algorithm for the former would yield 
an efficient algorithm for the graph isomorphism problem 0, 0, S Q , while an efficient algorithm for the later would 
yield an efficient algorithm for certain unique shortest vector in a lattice problems [7j. These two reductions form 
the foundation upon which interest in the hidden subgroup problem is based, since efficient algorithms for either of 
these two problems would expand the known power of quantum computers over classical computers for significant 
computational problems. 

The standard approach to solving the hidden subgroup problem for the group Q on a quantum computer is as follows. 
First one creates a superposition over all possible group elements, — i= X) g gg \9)- Following this one computes the 

function / from the HSP in an ancillary register, producing the states 

Lx>>®i/fo)]>- a) 

\ Q \ a ^g 



Since the function / is generally assumed to have no structure, this register is then measured or discarded. If the 
function / hides the subgroup 7i, then this produces a random coset state \gT~L), where 

i.^> = -i E I**)- ( 2 ) 

v\ H \ hen 

Here g is a coset representative, and each of the coset states is produced at random with equal probability. If we 
express this state as a density matrix, we obtain the so-called hidden subgroup state 

PH = W £ WW- (3) 

cosets gTi 

The standard approach to the hidden subgroup problem attempts to construct efficient quantum circuits for identifying 
Ti given a polynomial number of copies of the hidden subgroup state fm . 

Given a hidden subgroup state pn a symmetry argument immediately tells you that without a loss of generality, 
one can perform a unitary transform on this state which better expresses the structure of the information stored in 
pu- In particular if we define the left regular representation of the group Q, via DL(g)\g') = \gg'), then pn commutes 
with this representation: Dh{g)Pn — pi-iD^g) for all g € Q and all possible subgroups TL. Via Schur's lemma this 
tells us that there is a basis in which every p-yi is block diagonal. In particular we can decompose pn into a direct 
sum of states as 

PW = 0^®^. ( 4 ) 
where the direct sum is over all irreps p of Q, is the dimension of the pth irrep, and 

|y| hen 
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with is the /ith irreducible representation (irrep) of Q. The transform which block diagonalizes pn is the quantum 
Fourier transform over Q. We refer the reader to [1JJ for details. The main point here being, however, that the hidden 
subgroup state pu is symmetric with respect to a representation of Q, and without loss of generality this symmetry 
implies that a unitary basis change can be made which better reveals the information stored in p^. 



III. SIMON'S ALGORITHM AND CLEBSCH-GORDAN TRANSFORMS 



Simon's algorithm is the hidden subgroup problem on the group Z?? where the hidden subgroup is an order two 
subgroup. We denote elements of this group as length n bitstrings z £ {0, 1}", and group multiplication simply 
corresponds to bitwise addition modulo 2. The hidden involution can be specified by a single bitstring z £ {0, 1}™ 
corresponding to the subgroup {0™, z}. We are guaranteed that the function / hiding z satisfies f(x) = f(y) iff y = x 
or y = x + z. The representation theory of Z 2 l is quite simple. Every irrep is one dimensional and is parameterized 
by a vector r £ {0, 1}™. In particular the irrep is given by D r (x) — (— l) x ' r , where a ■ b — Y^i=i a *&« mod 2. 

Let us briefly review Simon's original algorithm for this problem [8j]. Simon's algorithm proceeds by the standard 
method for hidden subgroup algorithms on quantum computers. Following our description of the standard method 
above, we see that this produces the random coset state 
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(\x) + \x + z)), 



(6) 



where x is chosen uniformly at random from {0, 1}™. Following our discussion above, one can then, without loss of 
generality performs a Fourier transform over Z 2 on this hidden subgroup state. The Fourier transform over ZJ is 
nothing more than H® n where H is the Hadamard transform, 
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1 1 

1 -1 



(7) 



If one applies H® n on the random coset state one obtains the state 
—^= V [(-l) a -» + (-lWv+*) 1 ' ' 

on+l ^ L 



ye{o,i}" 



y 

VZ ye{o,iy 



(_!)*•» [1 + (-1)-*] \y). 



(8) 



Next notice that if you measure this state you will obtain a random vector y such that y ■ z = 0. Notice, importantly, 
here that in terms of group representation theory, y £ {0, 1}", is an irrep label. Thus we perform the quantum Fourier 
transform over Z 2 and measure the irrep label. Up to this stage, all of Simon's algorithm could have been motivated 
by simple observations about the symmetry of the hidden subgroup state. But the next stage of the algorithm is does 
not appear to have a symmetry argument. In particular, the next step in Simon's algorithm is to perform the above 
procedure n — 1 times and then uses Gaussian elimination to identify y. Note that with high probability random 
y's such that y ■ z = are linearly independent, so that this procedure succeeds with high probability. While the 
Gaussian elimination here is an obvious approach to the problem, a natural question to ask is whether this part of 
the transform can be interpreted in terms of symmetry. 

Consider two irreducible representations of a group Q: £> Ml and D^ 2 . Then there is a representation of this group, 
which is called the direct product representation, given by D{g) — D fll (g) C3 D fI2 (g). Since this is a representation of 
the group, it is decomposable into a direct sum of irreducible representations of Q: 



D{g) = D Ml (g) ® D^(g) =0/^ iM ® D„{g), 



(9) 



where ^ 2 is the number of times irrep p, appears in this representation. The unitary transform that enacts the 
above basis change is the Clebsch-Gordan transform [Til. l24l. [25|. 

For the group Z§ , like for all Abelian groups, the Clebsch-Gordan transform is rather simple. Recall that irreps of 
Zj are parameterized by vectors r £ {0, 1}™. Then the Clebsch-Gordan transform is 



D ri (g) <g> D r2 ( 5 ) = D ri+r2 (g), 



(10) 



where r% are the irrep labels and r\ +r2 is the new irrep label produced by bitwise addition modulo 2. In other words, 
a Clebsch-Gordan transform over Z 2 l corresponds to nothing more than bitwise addition modulo 2 of the irrep labels. 
But this is exactly what is performed in Gaussian elimination: one selectively performs addition between the different 
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y vectors, which, recall, are irrep labels. In other words, the Gaussian elimination step in Simon's algorithm can be 
reinterpreted as selective Clebsch-Gordan transforms over Z£ . Thus while this last step of Simon's algorithm is usually 
not understood in terms of a representation theoretic explanation, one can indeed provide such an interpretation by 
noting that this step is nothing more than a Clebsch-Gordan sieve [9l [ToL Hlj]. 

Given that there is a Clebsch-Gordan transform hidden inside of Simon's algorithm, a natural question is to ask 
whether Clebsch-Gordan transforms can be used to efficiently solve the hidden involution problem for groups Q n for 
some constant sized group Q . Further, as has been argued previously, an important class of algorithms are those which 
use the multiplicity space of the Clebsch-Gordan transform 11]. Here we will consider the hidden involution problem 
for the group X>J where D4 is the dihedral group of order eight. This group is smoothly solvable (it is solvable, and 
has abelian factor groups of constant exponent) and therefore the algorithm of Friedl, Ivanyos, Magniez, Santha, and 
Sen [l2j can be used to solve the hidden subgroup problem over this group. We return to this group thus not to derive 
a new hidden subgroup algorithm, but to explore a small example of a hidden subgroup problem where one can make 
progress by thinking about Clebsch-Gordan transforms. This complements our previous work wherein we showed 
that Clebsch-Gordan transforms could be used to understand how an efficient quantum algorithm for the Heisenberg 
hidden subgroup problem works [TJ H3] . 



IV. THE GROUP r> 4 



We begin by describing some relevant facts about the group V4. V4 is the group of symmetries of a square 
(it is not the group of the quaternions which is the other non- abelian group of order eight.) It has eight group 
elements which we will label by r t s k where t S {0,1} and s € {0,1,2,3} and is defined by the multiplication rule 
r t s k r t s k — r t+t s (- 1 ) tfc + fc , £> 4 is a semidirect product of Z4 and Z2. 

The representation theory of T>4 is straightforward [261 ] . There are five different irreducible representations (irreps) 
of D4, four one dimensional irreps and one two dimensional irrep. The one dimensional irreps are given by 



D t (fa 



1, 



A,(rV) = (-1)', D r (rV) = (-1)*, and D ro (rV) = (-1) 



\k+t 



while the two dimensional irrep is given by 



D 1 (r*s k ) 



uj k 5 t fi w k 5 t ,i 
w k 5 t ,i Lo~ k 6 t ,o 



(11) 



(12) 



where uo — exp [^f 1 ] = i- Instead of using these irreducible representations, we will find it useful to introduce the 
follow two dimensional (sometimes reducible) representations of D4, 



Di{r*a 



u) jk 5 t ,o u jk S t ,i 



(13) 



where j e Z4. It is easy to check that Dq is reducible to D a and D t , D2 is reducible to D r and D ra , and D3 is 
equivalent to D\. Also note that XDjX = D_j where X is the Pauli X operator. 

There are ten different subgroups of D4. We will be interested in the trivial and order two subgroups which contain 
a reflection. We let Ho : o = {e} be the trivial subgroup and Hij = {e, rs 1 }, I £ {0, 1, 2, 3} be the order two subgroups 
labeled naturally. Note that Hi,o is conjugate to Hi,2 and Hi,i is conjugate to Hi : 3- 

The motivation behind our algorithm is the Clebsch-Gordan series for D4. In fact we will be most interested in the 
Clebsch-Gordan series, not over the irreps, but over the (sometimes) reducible representations Dj defined in Eq. (jri 
In this case the Clebsch-Gordan series is 



Di (5) <8> Dj(g) = D i+j (g) ® A-j(ff), 
where i,j € Z 4 and the addition and subtraction are done mod 4. 



(14) 



V. SIMON'S PROBLEM ON DJ. 



We will consider Simon's problem on V'l . In particular we will consider the HSP over 2?J when the hidden subgroup 
is order two. We can label these subgroups by 



((Mi),(W 2 ),...,(Wn)), where (tj, h) S {(0, 0), (1, 0), (1, 1), (1, 2), (1, 3)}, (15) 
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( | x? =1 r"'s fc -) + | x? =1 ( r « ! +*. s (-i) t *^+'.)) , (17) 



corresponding to the subgroup consisting of the identity and the element x™ =1 r 4i ,s fci (if all the U = only the identity 
element is included, we will exclude this case for now.) It will be useful to label the hidden subgroup by the vectors 
t G l\ l and I G ZJ. 

We will follow the standard method for the hidden subgroup problem. When we query the function / which hides 
the hidden subgroup TL in superposition over all possible group elements we obtain the state 

TP EE i x -i rUgkt ) ® i/(xr=i^^)>- (i6) 

If we now throw away the register where the function has been evaluated, we obtain a random coset state 

\u, k) = -L (| x? =1 r"« S fc «) + | x? =1 (r"« S fc «rV*» 

-71 (I 

where ugZJ and fe G ZJ. We will obtain a particular coset state with uniform equal probability over all possible u 
and k vectors. Now suppose that we perform a quantum Fourier transform or its inverse over Z4 on the individual s 
registers conditional on whether the r register is e (forward QFT) or r (inverse QFT) for the above state. If we then 
measure the resulting register we will obtain fj, G Z", uniformly at random, and the state 

_L (| x r «*j + w £? =1 (-i)" i+ti ^ J x r Ui+U^ (18) 

If instead of using the group elements to label these states, we use a binary bit string to represent this register, we 
obtain the state 

_L(| 6> + JE^l-V«»k ]b + t) ), (19) 

where d € and the addition b + t is done componentwise. Thus to recap, the above procedure produces a uniformly 
random /x G ZJ along with the state in Eq. (|19[) where b is chosen uniformly from Z£ . Recall that we wish to determine 
t and I. 



VI. CLEBSCH-GORDAN TRANSFORM MOTIVATION FOR THE QUANTUM ALGORITHM 



Now we will explain in slightly more detail our motivation for the algorithm which we are about to derive. A 
variation on the hidden subgroup problem which is often as difficult as the full hidden subgroup problem is to identify, 
instead of the subgroup, the set of the conjugate subgroups to which the hidden subgroup belongs. This problem 
is called the hidden subgroup conjugacy problem 11]. Two subgroups Tii c Q and TI2 C Q are conjugate to each 
other if there exists an element of g G G, such that Hi — {ghg^ 1 , h G 0.2}- The notion of conjugate subgroups forms 
an equivalence relation among subgroups. For many groups, including the important symmetric group, the hidden 
subgroup conjugacy problem is equivalent to the hidden subgroup problem [ill. [27|. The hidden subgroup conjugacy 
problem, when cast as a state identification problem for quantum states, has an extra symmetry. In particular for the 
case where we have queried a the hidden subgroup m times using the standard method, the state distinction problem 
has a symmetry related to the diagonal action of the group on these states. We refer the reader to [ll[ for a more 
detailed discussion of this symmetry. 

In [ll[ the symmetry of the hidden subgroup conjugacy problem states was shown to lead naturally to the Clebsch- 
Gordan transform over the relevant finite group. In [111 ] it was shown that for the hidden subgroup conjugacy problem, 
information about the hidden subgroup conjugacy is found in the multiplicity space of multiple copies of the hidden 
subgroup states. For the case of the Heisenberg hidden subgroup group, a case which had previously been shown 
to admit an efficient quantum algorithm in (20j , it was shown that measurement of the multiplicity space could be 
used to solve the hidden subgroup problem efficient [ill ]. Thus motivated, we can examine the hidden subgroup 
conjugacy problem for n copies of the dihedral group where the hidden subgroups are involutions. For the dihedral 
group of order eight, the subgroups, {e,r} and {e,rs s } are conjugate to each other, as are {e,rs} and {e,rs 3 }. For 
the reducible Di representations described above, the Clebsch-Gordan transform is rather simple, being related to the 
simple Clebsch-Gordan series Di(g) £g> Dj(g) = Di + j(g) © Di-j(g). Define the double controlled- not 



U 



10 
1 
10 
10 



(20) 
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This operation takes the computational basis state \x,y) to \x © y, x). If we apply this transform to two reducible 
representation Di and Dj, this transform enacts a Clebsch-Gordan transform. In particular, 

[/(AG?) ® D 3 (g))U^ = D i+Sj (g). (21) 

s=±l 

In other words, after applying the U transform, the first qubit will contain the multiplicity of the new representation 
and the second qubit will be the space where this representation acts. For DJ, a bitwise application of n Ua is the 
Clebsch-Gordan transform over DJ. Now from analysis of the hidden subgroup conjugacy problem we know that 
information about the subgroup conjugacy of the hidden subgroup must lie in the multiplicity space after a Clebsch- 
Gordan transform. Thus motivated our algorithm will proceed from exactly this first step to produce an efficient 
quantum algorithm. 



VII. THE QUANTUM ALGORITHM 

Recall from the previous section that the standard method plus a conditional quantum Fourier transform produces 
a uniformly random fieZ™ and b G Z 2 along with the state 

l=(\b)+u^=^ bi+H ^\b + t)) (22) 

Our quantum algorithm will proceed in three stages. In the first state we will determine t. In the second state we 
will determine the parity of I. In the final stage will determine I. 



A. Determining t 

Suppose we have two coset states 

i= (\ bl)+u} ^A-^ +t H^U lh+t ^ ® _L (|6 2 ) +^ 1 (- 1 ) (62)l+tl ^)^|6 2 , (23) 

and we apply, bitwise, n double controllcd-not's (Us) between these two registers and the addition is done over Z 2 . 
This will produce the state 

+ h) ® (jfox) + w E? =1 [(-i) (fcl) ' + "(».i)i+(-i) (fca) ' +t '(M 2 )iHi| &1 + t )) 

+ l -\b 1 + b 2+ t)® (u^-^ b2)i+H ^\ bl ) +u X? =1 <.-i)™* +t <M*ii\ bl . (24) 

We can rewrite this in the form 

\\bi + b 2 ) ® + £ „Er= 1 (-i) ( » i >' +t '[(/»i)i+(-i) ( » i) ' +(fca, '(M 2 )i]ii| &1 + t> ) 

+ i UJ ^-^ +t H^ lbl+b2+t) ^ (| 6l)+w E? =1 (-i) (bl) ' +t M(Mi) i -(-i)^" + ^"(M 2 )^| 6l+t) ). (25 ) 

A further simplification is to write this in a summed form: 

1 £ w £? =1 (-i) (i ^ +t M^)^c 2|6i +b2 + C2t) (| 5l> +w Er= 1 (-i) ( » l) « +t '[(Mi)i+(-i)^ ) « + ^ , ' +e ='(M 2 ) < Hi| 6l . (26) 

Notice, now that the second register contains a state just like the original coset states, except now for different /x's. In 
particular, for the first part of the superposition, the new p, has fa — (/xi), + (— l)^ i+ ^ i (^ 2 )i, while for the second 
part of the superposition, the new \i has fa = (fa)i — (— l)( bl ) i +( &2 ) i (p 2 )i- Note that the sign of this addition of fa 
and fa) components is given by the bitstring in the first register. Indeed, the above transform corresponds exactly to 
the Clebsch-Gordan transform over DJ. 
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Suppose that we produce m coset states and in a cascade perform the double control-not operation on these states. 
The resulting state will be 

== ^2 w ^= 2E '= l(_1)<63>l+tl(w)li ' Cj |6i + b 2 +c 2 t) <g> \bi + b 3 + c 3 t) <g> Ih+bm + Cmt) 



>2 

C2,...,C 



<g> (l^) + ^ 1 (-i) (6l) ' + M(P 1 ) l +E™ 2 (-i) (6l »' + ^^^fe) I ]^| 6l + t) ) (27) 

Now notice the following. From the first m — 1 registers, along with the values of the /Ltj we can compute part of that 
phase which appears in the last register 

m 

Mi = (Mi), +E(- 1 ) (bl)l+(6,)l+Cjts (^)«- (28) 
We can compute this value an place it in an ancilla register, thus producing the state 

* y w £r =2 £r =1 (-i)^ )i+ '^)^^ (29 ) 



v c 2 ,...,c m G^2 

n m 

We will now measure this last ancilla register. Now for m much less than n, the most likely outcome is that the 
above superposition will contain a unique value in this last register for each term in the superposition (ignoring 
superpositions over the mth register.) This is because for random \ii the phase in Eq. (|28[) a random ± combination 
of these terms will likely only produce only one solution. This changes, however when m — n + 2. 

In order to understand this, consider the following problem, motivated by the hidden subgroup problem over T>± 
(which is not hard, but which is illustrative.) In this problem you are given k random Vi £ Z4. Consider the function 
from {+l,-l} fc to {0,1,2,3}, 

/(si, . . . , s fe ) = SjVj mod 4. (30) 

i 

First note that because —0 = mod 4, — 2 = 2 mod 4, —1 = 3 mod 4, and —3 = 1 mod 4, the parity of /(si, . . . , Sf.) 
for all Si £ {+1, —1} is the same. In other words, for any possible Sj = ±1, / can either be in {0, 2} or {1, 3}. Thus 
suppose you are given random Vi £ Z4, and a value of v to t = /(si, ■ ■ ■ , Sfc) for some fixed Sj. Given this information, 
you are then required to return a list of s, whose sign can be flipped and still retain the total Vtot- This can easily 
be done as follows. Let lOj denote the parity of (i.e. if £ {0, 2} and 1 otherwise.) If Wi = 0, then flipping the 
sign of Si will produce the same Vtot, since ±0 = and ±2 = 2 over Z4. Further since {1, 3} ± {1, 3} £ {0, 2}, flipping 
any even number of s, where uij = 1 also keeps the Vtot- In other words if you consider all vectors y £ l\ such that 
y ■ w = 0, then simultaneously flipping the sign where yi = 1 preserves the sum. (Note there is a degenerate case 
where all Wi = which we will ignore for now.) 

Now extend this problem to the case we are considering where m = n + 2. For each i we can apply the above proce- 
dure to the numbers {^2)1, ■ ■ ■ , (fJ> m )i with a total of (ntot)i — (pi)i- This will produce a such that simultaneously 
flipping the Wi = 1 bits where tOj • itfj = will keep this term in the sum the same. Since we need to simultaneously 
flip the bits not just for a fixed i but across all i and retain the same total, we will obtain a series of n equation 
Wi ■ s = Q, where the Wi £ Z™ -1 = Z£ . With probability greater than one half we will obtain a s which satisfies 
these equations (and this vector can be found efficiently using Gaussian elimination.) 

Thus with high probability we have identified a vector s £ Z^ +1 indicating which of the m = 2, . . . n + 2 signs can 
be flipped to obtain the same sum in the last register. Having identified those locations where the sign can be flipped 
an obtain the same sum, now consider the ztli registers where sj = 1. The state of these registers will be 
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w EJf^EW-D^(«^ (g) | 6l + 6i + Cit)+ ^^ 1 ^ 1 (- 1 ) ( ^ > ^^^^) (g) \ h + bi + { i- Ci )t) 

i\si—l i\si — l 

(31)" 

where Cj are now some fixed but unknown {0, l}s. The global phase can be pulled out obtaining 



1 

V2 



i\si — 1 i\si — l 



(32) 



8 



Note that by measuring the other registers where Sj = and using the value of the total fitot in the ancilla register, 
we can calculate in another ancilla register the value 



j=2\s ]= l 



(33) 



A consequence of finding the Sj = 1 where flipping the sign of the ±/ij terms obtain the same sum is that the ±/Xj 
sums over these i must all be made up of vectors from {0, 2}". Thus the above terms must be in {0, 2}. Since ±0 = 
and ±2 = 2 over Z4, this sum must be 



n = - E (-i) ( ^ +c ^X- 

j=2|* J= l 



(34) 



Now noting that the phase in Eq. (|34[) is zero where £j = (since this implies U — 0), we can express the state in 
Eq. J33]) as 



1 

71 



(g) |6 1 +6 l + c,t)+^= 1 r ' t - i ' (g) \bi + h + (1 - a)t) 

i\si — l i\si — 1 



(35) 



Note that € {0, 2}, so that we could write this as 



1 
71 



\b 1 + b l + c l t) + {-l)^=^ uh (9) [61 + fei + (1 - r^)*) 



i|Sj=l 



where Pi = ri/2. Since bi and are given uniformly, we can rewrite this state as 

1 

V2 



\v) + (-l)^P^ h \v + t) 



(36) 



(37) 



where v is a uniformly random element of Z^ 15 , s is the number of Sj which equal 1, and t is the vector in which 
consists of s repetitions of t. We can further simplify this by applying double-controlled nots bitwise to this expression 
starting with the first n elements acting on the second, the the second on the third, etc. This then reduce the first s 



ZgS to random vectors and the final vector will be 



v/2 



\w) + (-l)^ p ' uh \w + t) 



(38) 



where w is a uniformly random element of . 

Now we are in a similar situation to where we started, however instead of the phase being a power of lj the phase 
is a power of —1: in other words we have a procedure for producing from n + 2 copies of states like that in Eq. |22|) 
a state of a similar form but with the phase doubled. It therefore follows that if we apply this procedure to n + 2 of 
the above states, we will double the phase once more. Thus by using (n + 2) 2 copes of the states in Eq. (|22|) we can 
produce another doubling of the phase and therefore the state 



1 

72 



\x) + (-l)£?=i 2 M\x + t) 



v/2 



•*)] 



(39) 



This, however, is just the state which serves as input to Simon's algorithm for determining a hidden subgroup in 
I2 where the hidden subgroup is {0,i}. Thus by using 0{n) copies of this state we can use Simon's algorithm to 
determine t. In total we have used 0(n 3 ) queries to determine the t. 



B. Determining the Parity of I 

Having determined t, we now show how to determine the parity of I. Since we know t, we can now query the 
function / over different superpositions where the U — 1 and a fixed (irrelevant) bit string in the locations where 
ti = 0. After doing this we will produce the following state over the locations where ti = 1: 

-L(|6)+ w E? =1 -(-D^|^ (40) 
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If we now run the algorithm described in the previous subsection on n + 2 copies of this state, we will obtain the state 

-L(|„) + (41) 

where the pi are uniformly random elements of Z2 which we know. Now suppose that we perform a measurement of 
such a state in the basis \ipx,±) — ^75 {\%} ± \x}). Then, depending on whether you get a \ip x ,+) or \ipx,~), we know 
that the k are solutions to 

^2pik = c mod 2 (42) 

i 

where c e {0,1}. Thus by running this procedure n times we will obtain a set of equations for the parity of the 
li which, with high probability are linearly independent and can be obtained efficiently using Gaussian elimination. 
Thus we have can determine the parity of the k using 0{n 2 ) queries to the hidden subgroup oracle. 

C. Determining / 

The final stage of the algorithm is determining I beyond the parity of the k. Note that having determined t and the 
parity of the k is equivalent to the hidden subgroup conjugacy problem for DJ. Suppose that we wish to determine 
the value of a particular Z, and we know that parity of U is such that li £ {0, 2}. When we are querying the function 
in the standard setup for the hidden subgroup problem we also compute an extra function in an ancilla register on 
the particular ith element of T>2- In particular if we calculate the function which maps the the element r l s k to 
k + 2t mod 2, then this function will be constant on the same subgroup as before if li = 0. If, however li — 2, the 
subgroup will no longer be constant on this subgroup. Thus by running, either of the procedures in the previous 
two subsections, we can determine which of these two cases hold and therefore whether li = or Z, = 2. A similar 
approach can be taken for U = 1 versus U = 3. Further each of these can be carried out for the different ith terms in 
the hidden subgroup problem, and therefore U can be efficiently computed for all i using this procedure. 

VIII. CONCLUSION 

We have shown that the Gaussian elimination in Simon's algorithm can be interpreted in terms of a Clebsch-Gordan 
transform. This led us to consider the hidden involution problem for 2?J. Using Clebsch-Gordan transforms over DJ, 
along with measurements on the multiplicity space of this transform, an efficient quantum algorithm for the hidden 
involution problem over T>2 was derived. An important open question is, of course, whether the approach of using 
Clebsch-Gordan transforms can be used to obtain efficient quantum algorithms for the diheral group or the symmetric 
group. While we do not know the answer to this question, we do note that our algorithm uses the Clebsch-Gordan 
transform in a recursive fashion (first to filter the phase to powers of ( — 1) and then to filter this phase to 1.) While 
this procedure appears to be a particular to dihedral group of order eight, it is important to investigate this approach 
for dihedral groups which are higher powers of two. 
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